Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users receive more debt than they should on second borrowing

notbozho

Summary

The DebtToken.mint() function has a check if the usageIndex has increased from the last minting/burning.

uint256 scaledBalance = balanceOf(onBehalfOf);
​
uint256 balanceIncrease = 0;
if (_userState[onBehalfOf].index != 0 && _userState[onBehalfOf].index < index) {
balanceIncrease = scaledBalance.rayMul(index) - scaledBalance.rayMul(_userState[onBehalfOf].index);
}
​
_userState[onBehalfOf].index = index.toUint128();
​
uint256 amountToMint = amount + balanceIncrease;

DebtToken.sol#150

We can see that if the user has already borrowed and the usageIndex has increased, the user will receive a increased amount of debt tokens to account for the increase in usageIndex.

Vulnerability Details

The problem is that balanceOf(user) returns the amount of debt tokens multiplied by the usageIndex

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedDebt());
}

DebtToken.sol#223

When the user borrows again and then the balanceIncrease is calculated, we can observe that the balanceOf() is multiplied again by the index:

(balanceOf(user) * newUsageIndex) - (balanceOf(user) * oldUsageIndex)

Technically, the function does:

balanceIncrease = (debtBalanceOfUser * newUsageIndex * newUsageIndex) - (debtBalanceOfUser * newUsageIndex * oldUsageIndex)

Same issue is also found in RToken.mint().

Impact

The user will receive newUsageIndex times more debt tokens than they should have.

Recommendation

The balanceOf() function should return the amount of debt tokens without multiplying by the usageIndex.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DebtToken::mint miscalculates debt by applying interest twice, inflating borrow amounts and risking premature liquidations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.